sprint20-23: tests + documentation + guest access + infrastructure + migrations 0059

app/services/entity_permission_service.py

@@ -324,8 +324,9 @@ async def get_effective_access(
     3. Direct user permission
     4. Group permission (via user_groups)
     5. Role permission (via user_tenants.role_id)
-    6. owner_id IS NULL → 'read' (tenant-owned, visible to all with module permission)
-    7. No access → 'none'
+    6. Guest permission (principal_type='guest')
+    7. owner_id IS NULL → 'read' (tenant-owned, visible to all with module permission)
+    8. No access → 'none'
 
     Returns: 'none' | 'read' | 'write' | 'admin' | 'delete' | 'owner'
     """
@@ -386,6 +387,14 @@ async def get_effective_access(
                 EntityPermission.principal_id == role_id,
             )
         )
+    # Guest permission — only if user_id is actually a guest_user_id
+    # (Guest users have no groups/roles, only direct entity_permissions)
+    principal_conditions.append(
+        and_(
+            EntityPermission.principal_type == "guest",
+            EntityPermission.principal_id == user_id,
+        )
+    )
 
     # Query permissions
     now = datetime.now(UTC)
@@ -503,6 +512,13 @@ async def get_visible_ids(
                 EntityPermission.principal_id == role_id,
             )
         )
+    # Guest permission — guest users have no groups/roles
+    principal_conditions.append(
+        and_(
+            EntityPermission.principal_type == "guest",
+            EntityPermission.principal_id == user_id,
+        )
+    )
 
     perm_q = await db.execute(
         select(EntityPermission.entity_id, EntityPermission.permission_level)
@@ -595,6 +611,13 @@ async def batch_get_effective_access(
                 EntityPermission.principal_id == role_id,
             )
         )
+    # Guest permission — guest users have no groups/roles
+    principal_conditions.append(
+        and_(
+            EntityPermission.principal_type == "guest",
+            EntityPermission.principal_id == user_id,
+        )
+    )
 
     perm_q = await db.execute(
         select(EntityPermission.entity_id, EntityPermission.permission_level)